CVE-2026-96825

MediumCVSS 4.2/10Last modified Sep 30, 2026

Description

Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-968267.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List alloCVE-2026-968277.6Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.CVE-2026-968287.6Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-968296.5Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.CVE-2026-968307.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.CVE-2026-968318.8Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.CVE-2026-968327.2Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.CVE-2026-968337.2Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.CVE-2026-968346.5Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.CVE-2026-968356.5Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.CVE-2026-968367.1Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.CVE-2026-968378.8Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.
CVE-2026-96825: Medium severity, CVSS 4.2 | Vulnix